Who Called Me

Privacy Policy

Last updated: 22 September 2026

This policy explains how Who Called Me ("we", "us") handles personal information, following the information privacy principles in the Privacy Act 2020. You can use the site without an account and without telling us who you are.

What we collect

  • Reports you post: the report text, the call type, and an optional display name and company name. Reports are public. Email addresses and phone numbers other than the one being reported are removed automatically.
  • Quick votes ("It was a scam or spam" / "It was legitimate"): your vote and a one-way hash of your IP address, so each visitor gets one vote per number.
  • Contact form messages: your message, and your name and email address if you choose to give them. We use your email only to reply to you.
  • Lookups: when a number page is viewed, we record the number and a one-way hash of your IP address to count searches, show trending numbers and prevent abuse.

We do not store your IP address. Wherever we need to tell visitors apart (limiting spam, one vote per person, counting searches), we keep only a salted one-way hash of it, which cannot be turned back into your address.

Stored only on your device

The homepage can show your recent lookups. That list is kept in your own browser's storage and never sent to us. Clearing your browser's site data removes it.

Cookies, analytics and advertising

We use Google Tag Manager to manage analytics and measurement tags, such as Google Analytics, which can set cookies and collect information about how you use the site, including your device, browser and approximate location. We may show advertising served by Google AdSense, and Google and its partners may use cookies or device identifiers to personalise ads and measure performance. You can control ad personalisation in your Google account settings, and block or delete cookies in your browser. Where the law requires consent (for example for visitors from the EEA or UK), we ask before personalised ads are served.

Our anti-spam check, Cloudflare Turnstile, runs when you post a report or send a message. It processes technical signals such as your IP address and browser to tell people from bots.

Phone number and business information

Number details on this site (service type, network, region and whether a number is in use) come from the Number Administration Deed register, which the telecommunications industry maintains. Business listings (a business's name, category, suburb and website) come from openly licensed places data published by the Overture Maps Foundation. We do not store street addresses, and we do not publish residential listings or subscriber identities. Scam alerts summarise warnings that organisations publish on their own websites.

How we use information

To run the site: publishing reports, working out verdicts, showing trends, preventing spam and abuse, replying to messages, handling removal requests, and understanding how the site is used so we can improve it. We do not sell personal information.

Who we share it with

We use service providers to run the site: Cloudflare (hosting, database, security and anti-spam) and Google (tag management, analytics and advertising). They may store or process information outside New Zealand, including in the United States. We may also disclose information where the law requires it, for example to comply with a court order.

How long we keep it

Reports stay published while they are relevant, unless removed through ourmoderation or content removalprocesses. Hashed lookup and vote records are kept only as long as they are useful for trends and abuse prevention. Contact messages are kept while we deal with them and for a reasonable period afterwards.

Security

Information is stored with Cloudflare and protected by access controls and encryption in transit. No system is perfectly secure, but we take reasonable steps to protect what we hold.

Access, correction and removal

You can ask to see or correct personal information we hold about you, or ask us to remove a report or listing, by emailing hello@whoiscallingme.net, through thecontact form or the content removal process. Because we store only hashed IP addresses, we may be unable to link anonymous activity to you. We normally respond within 2 business days.

Complaints

If you have a privacy concern, email hello@whoiscallingme.net or contact usfirst and we will respond within 30 days. If you are not satisfied, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

Changes to this policy

We may update this policy as the site changes. The date at the top shows when it was last updated.